[00:04.560 --> 00:05.140]  All right.
[00:05.680 --> 00:07.020]  Thanks for coming here.
[00:07.180 --> 00:12.480]  So the theme for HOPE X is dissent, and I guess that makes me the comic relief.
[00:13.320 --> 00:17.760]  So everything up to this point might have been a little bit heavy, so let's try to lighten it up a little bit.
[00:18.400 --> 00:20.820]  So this is Rickrolling Your Neighbors with Google Chromecast.
[00:20.960 --> 00:25.080]  I'm Dan, or Alt F4, my friends call me Alt, and let's get going.
[00:25.540 --> 00:33.600]  So really quick at first though, I want to acknowledge quickly, I suppose, the kind of media blitz that sort of surrounded this for the last 48 hours.
[00:34.900 --> 00:38.740]  The machine that I made to kind of automate this whole attack.
[00:39.100 --> 00:47.120]  And the kind of Chromecast thing around it has sort of spread through the Internet with awesome quotes saying that like it's a devastating attack or like it shows no mercy.
[00:47.320 --> 00:50.540]  It's been like in Wired and Gizmodo and The Guardian and crazy stuff.
[00:50.660 --> 00:55.660]  So that's been totally crazy, and it's been hard to follow, but it's been kind of cool too.
[00:56.520 --> 01:01.540]  So this has been me for the last 48 hours, trying to respond to everybody on the Internet.
[01:01.700 --> 01:03.040]  And this has been a bad idea from the beginning.
[01:04.700 --> 01:06.900]  But yeah, I guess that's all I have to say about that.
[01:07.000 --> 01:07.580]  Let's get into it.
[01:08.320 --> 01:10.360]  So this is a talk about hijacking TVs.
[01:11.080 --> 01:17.280]  So this is like one of the oldest and most time-honored hacker traditions, which is pranking your friends and neighbors, right?
[01:17.740 --> 01:24.140]  So even though things like privacy and security are really, really important, I really care about that, my normal day-to-day job.
[01:25.120 --> 01:30.380]  We shouldn't let go of our, you know, good hacker traditions and we shouldn't let go of good old fun too.
[01:30.560 --> 01:35.200]  So this is about something that is also used in like Hollywood all the time.
[01:35.340 --> 01:37.320]  It's practically like a TV trope.
[01:37.460 --> 01:43.180]  Some sort of a Hollywood cliche where like the hacker quickly types something and then like a bunch of stuff shows up on screens all around.
[01:44.460 --> 01:47.780]  So like this is gonna be something extremely similar to that, but you don't have to type a whole lot.
[01:47.880 --> 01:48.460]  That's the best part.
[01:49.180 --> 01:54.340]  So the device that I made, the picture you might see around online, is called the Rickmote controller.
[01:55.080 --> 01:57.080]  It's as clever a pun as I could come up with.
[01:58.140 --> 02:03.240]  It's made out of a Raspberry Pi and a 3D printed case and it's pretty slick looking, touch screen.
[02:03.660 --> 02:05.420]  The whole thing costs about like $100 to make.
[02:06.020 --> 02:08.140]  The 3D case is up on Thingiverse now.
[02:08.140 --> 02:08.940]  I've got the code on GitHub.
[02:10.600 --> 02:12.740]  So almost all of it is ready to go.
[02:12.860 --> 02:18.020]  I still have a few more things to release that will make it like super drop-dead easy to replicate.
[02:18.960 --> 02:21.600]  So that should be coming out in like the next two weeks or something like that.
[02:21.960 --> 02:23.440]  But just about everything else is online.
[02:23.640 --> 02:26.320]  Unless they secure the Chromecast, in which case you're kind of screwed.
[02:26.500 --> 02:27.820]  Because they are gonna do eventually.
[02:28.340 --> 02:29.020]  They might.
[02:30.080 --> 02:32.100]  We'll get into remediations later.
[02:32.220 --> 02:34.320]  The comment was about fixing the bug about the Chromecast.
[02:34.400 --> 02:37.360]  We'll get into that later, which essentially comes down to that.
[02:37.480 --> 02:41.540]  It might not be fixable, or at least it might not be fixable in a way that Google would find palatable.
[02:43.480 --> 02:49.040]  So first, I'm gonna show you a couple of cool instances of hacking in the movies.
[02:49.520 --> 02:51.580]  What hijacking TVs looks like.
[02:52.520 --> 02:53.900]  Oh, that's not the one.
[02:54.240 --> 02:56.120]  Trying to use track pad is hard.
[02:56.340 --> 02:57.100]  Dark suit.
[02:57.280 --> 03:02.400]  This has been corroborated by our allies and local intelligence on the ground.
[03:02.400 --> 03:06.580]  Indicating that these suits are quite possibly at this moment operational.
[03:07.860 --> 03:08.900]  Hold on my second, buddy.
[03:09.160 --> 03:09.540]  Let me see.
[03:10.900 --> 03:11.480]  Something here.
[03:11.680 --> 03:11.940]  Oh.
[03:12.300 --> 03:12.940]  Boy, I'm good.
[03:13.480 --> 03:14.540]  I come and need your screens.
[03:15.740 --> 03:16.420]  I need them.
[03:17.260 --> 03:18.440]  Time for a little transparency.
[03:19.060 --> 03:20.100]  Let's see what's really going on.
[03:20.240 --> 03:20.800]  What does he do?
[03:20.940 --> 03:25.360]  If you'll direct your attention to said screens, I believe that's North Korea.
[03:34.060 --> 03:35.640]  Can you turn that off?
[03:36.020 --> 03:36.700]  Take it off?
[03:37.020 --> 03:37.600]  I ran.
[03:38.140 --> 03:38.620]  I got those!
[03:38.920 --> 03:39.800]  I got those!
[03:39.820 --> 03:39.940]  I got those!
[03:40.160 --> 03:40.640]  I got those!
[03:42.460 --> 03:43.940]  I got those!
[03:43.940 --> 03:47.940]  Just like, in the middle of a congressional hearing, just busts out with some little doohickey.
[03:48.300 --> 03:50.260]  Like, hijacks the TV nearby it, right?
[03:50.640 --> 03:52.800]  And then, like, nobody can even seem to turn it off?
[03:53.020 --> 03:58.960]  Like, the guy from Hammer Industries is just, like, fiddling with, like, the DVR that's nearby it or something like that.
[03:59.020 --> 03:59.720]  So that was pretty cool.
[04:01.380 --> 04:03.300]  So I thought, like, man, that was kind of cool.
[04:03.380 --> 04:05.380]  But at the time, I was thinking, like, oh, come on.
[04:05.460 --> 04:07.080]  Like, the TV's not gonna be hooked up to something wireless.
[04:07.800 --> 04:08.080]  Right?
[04:08.160 --> 04:08.960]  That would be silly.
[04:09.120 --> 04:10.120]  Like, why would you do that?
[04:12.800 --> 04:14.660]  So, uh, the beginning of this is really great.
[04:14.740 --> 04:16.780]  You gotta listen to the awesome techno babble in the beginning of it.
[04:17.420 --> 04:17.580]  The floor.
[04:17.800 --> 04:20.240]  Our program uses existing wireless technology.
[04:20.820 --> 04:23.980]  Which we modified, transforming it into a completely new program.
[04:24.300 --> 04:25.020]  What do you call it?
[04:25.440 --> 04:25.920]  Spartacus.
[04:26.120 --> 04:26.620]  Why's that?
[04:26.820 --> 04:29.260]  I was named after the revolt of the slaves.
[04:30.640 --> 04:31.920]  The wireless webcast.
[04:32.640 --> 04:33.460]  We have that.
[04:34.360 --> 04:37.700]  Spartacus turns any specified broadcast terminal into its slave.
[04:38.040 --> 04:39.200]  We control the program.
[04:39.860 --> 04:40.140]  Watch.
[04:43.020 --> 04:43.560]  Take a look.
[04:43.800 --> 04:44.320]  Pick a screen.
[04:47.260 --> 04:48.080]  Hello, Billy Rudolph.
[04:58.930 --> 05:00.290]  Al Pacino is not amused.
[05:01.070 --> 05:01.410]  That was...
[05:01.850 --> 05:02.970]  So that was from the recruiter.
[05:03.050 --> 05:03.650]  Maybe he is amused.
[05:03.670 --> 05:04.030]  I'm not sure.
[05:04.130 --> 05:04.790]  I've never even seen the movie.
[05:06.450 --> 05:06.730]  Um...
[05:06.730 --> 05:07.150]  So, yeah.
[05:07.290 --> 05:08.310]  I don't know what that was about.
[05:08.570 --> 05:11.030]  Like, those are just TVs, like, definitely not hooked up to anything.
[05:11.210 --> 05:11.750]  But, you know, whatever.
[05:12.290 --> 05:15.450]  Um, they just, like, press a few buttons and some TVs start doing what they want.
[05:15.450 --> 05:16.850]  This incident just proved...
[05:16.850 --> 05:16.970]  And then, of course.
[05:17.530 --> 05:20.370]  ...without a doubt, that we need increased funding to stop...
[05:20.370 --> 05:20.590]  Hold on.
[05:20.750 --> 05:21.330]  I'm getting into tears.
[05:21.350 --> 05:22.290]  Hola, boys and girls.
[05:22.550 --> 05:28.730]  It is I, the serial killer, making my first coast-to-coast, worldwide, global television appearance.
[05:29.450 --> 05:31.010]  Yes, that's right.
[05:31.610 --> 05:35.490]  I'm here to tell you about this heinous scheme hatched from within Alex and Mineral.
[05:36.550 --> 05:37.790]  But for what, you ask?
[05:37.990 --> 05:38.850]  World domination?
[05:39.590 --> 05:39.950]  Nay.
[05:40.910 --> 05:42.990]  Something far more attacking.
[05:44.070 --> 05:46.310]  So that one actually has an air of plausibility about it.
[05:46.410 --> 05:49.350]  Kind of seems like they, like, hijacked, like, TV stations?
[05:49.430 --> 05:50.750]  Or maybe every TV station?
[05:50.790 --> 05:52.030]  Because, like, everybody was watching it.
[05:52.110 --> 05:54.430]  But it has some air of plausibility about it, at least.
[05:54.570 --> 05:55.390]  So kudos, I suppose.
[05:58.230 --> 05:59.290]  So, next slide.
[05:59.410 --> 06:02.410]  Now I'm going to show you what hijacking TVs looks like in the real world.
[06:13.140 --> 06:16.480]  We'll go through this in more detail a little bit later.
[06:46.390 --> 06:48.350]  The longest part is waiting for YouTube to load.
[07:02.660 --> 07:04.280]  Rick's got this very specific jig.
[07:04.420 --> 07:04.980]  It's hard to get down.
[07:07.720 --> 07:08.240]  All right.
[07:10.220 --> 07:12.340]  So, this is all about the Google Chromecast.
[07:12.460 --> 07:17.360]  So if you're not already familiar with the Chromecast, then it's what kind of looks right there.
[07:17.420 --> 07:18.920]  It's this little, tiny device.
[07:19.120 --> 07:20.180]  It's like 35 bucks.
[07:20.320 --> 07:21.400]  It's really easy to use.
[07:22.020 --> 07:22.940]  It's really cheap.
[07:23.540 --> 07:27.000]  And it's kind of Google's competitor to the Apple TV, maybe.
[07:28.060 --> 07:29.220]  But a lot more lightweight.
[07:29.480 --> 07:31.380]  So it doesn't have a whole lot of hardware interfaces.
[07:31.500 --> 07:33.020]  It plugs into your TV via HDMI.
[07:33.340 --> 07:34.200]  It powers over USB.
[07:34.940 --> 07:36.760]  And it streams Internet videos.
[07:36.880 --> 07:37.940]  So things like YouTube, obviously.
[07:38.720 --> 07:39.120]  Netflix.
[07:40.480 --> 07:41.100]  HBO Go.
[07:41.300 --> 07:41.700]  Things like that.
[07:43.840 --> 07:46.520]  So, a while ago, my friend Chris had got one of these.
[07:46.620 --> 07:50.180]  It was actually the first shipment back when the Chromecast was like really elite and hard to get.
[07:50.600 --> 07:53.780]  It sold out within minutes of it getting purchased.
[07:55.560 --> 07:57.200]  Yeah, my friend Chris got one.
[07:57.300 --> 07:58.780]  And he was telling me, man, this thing is so cool.
[07:59.020 --> 08:00.880]  I can just stream Netflix super easy.
[08:01.000 --> 08:02.820]  And it doesn't have to have some big expensive box.
[08:04.160 --> 08:05.880]  And it was really, really easy to set up.
[08:05.960 --> 08:08.060]  And he was kind of telling me the process about how we set it up.
[08:08.140 --> 08:10.360]  And I was thinking, oh, there is no way that is secure.
[08:10.980 --> 08:13.300]  And so I bought one purely to hack it.
[08:13.720 --> 08:15.180]  So like two weeks later I got the thing.
[08:15.340 --> 08:16.800]  And I opened the box and you see this.
[08:16.900 --> 08:19.740]  In case you can't see the writing there because it's kind of hard to see.
[08:19.820 --> 08:21.060]  It says there's three steps.
[08:21.240 --> 08:22.620]  There's one, plug it in.
[08:23.080 --> 08:24.580]  Step two, switch input.
[08:24.860 --> 08:25.260]  I'm like, okay.
[08:26.240 --> 08:27.820]  Step three, set it up.
[08:29.100 --> 08:30.360]  Like really, set it up.
[08:30.480 --> 08:31.780]  Like it just gives you a URL to go to.
[08:31.880 --> 08:33.180]  So there's not really a whole lot of information.
[08:33.660 --> 08:35.820]  That's been one of the themes about the Chromecast in general.
[08:35.820 --> 08:38.240]  Is that there's an official SDK and all that stuff.
[08:38.380 --> 08:40.460]  But there's not a whole lot of information about really under the hood.
[08:40.700 --> 08:42.040]  Like what the Chromecast is doing.
[08:42.260 --> 08:43.940]  Or how any of the apps that interact with it.
[08:44.020 --> 08:44.800]  Like really what they're doing.
[08:47.880 --> 08:49.580]  So I think that was a little bit like this.
[08:51.720 --> 08:53.800]  So if you can't read it, if you're in the back.
[08:54.100 --> 08:56.300]  On the left it says, how to draw an owl.
[08:56.580 --> 08:57.880]  Step one is draw some circles.
[08:58.040 --> 09:00.340]  And step two is draw the rest of the f*cking owl.
[09:03.200 --> 09:05.540]  So I kind of had to figure out what was step 1.5.
[09:05.540 --> 09:08.380]  So a lot of this talk is going to be step 1.5.
[09:09.800 --> 09:12.040]  So again, the Chromecast is really simple.
[09:12.180 --> 09:15.560]  It's got only like three interesting things on the exterior of it.
[09:15.740 --> 09:18.300]  It's got an HDMI port that plugs into the side of your TV.
[09:18.520 --> 09:20.440]  It's got a USB port that doesn't have any data lines.
[09:20.720 --> 09:25.940]  Like there's no... you can't like mount it as like a drive or something like that.
[09:26.100 --> 09:26.800]  It just powers.
[09:26.960 --> 09:28.660]  I think it might use the data line for extra power or whatever.
[09:28.780 --> 09:31.140]  But there's not actually anything interesting you can get from that.
[09:31.460 --> 09:33.480]  And certainly not anything we can get from an attacker, right?
[09:33.500 --> 09:34.460]  We're talking about remote stuff.
[09:34.460 --> 09:36.880]  You can plug into the Chromecast and of course you can do something with it.
[09:37.040 --> 09:38.580]  And then it's got one button on it.
[09:38.700 --> 09:39.660]  It's like a factory reset button.
[09:39.760 --> 09:42.800]  You unpower it, hold it down for like 10 seconds, and the factory resets.
[09:43.120 --> 09:45.100]  So not a whole lot there that's interesting to us.
[09:45.420 --> 09:48.120]  So a good question is like how do you actually set the stupid thing up?
[09:48.260 --> 09:49.840]  Because it's got to connect to your wireless, right?
[09:50.000 --> 09:51.700]  So you have to tell it your Wi-Fi password.
[09:51.700 --> 09:53.940]  So like how does that even happen?
[09:54.600 --> 09:55.820]  So a little diagram here.
[09:55.960 --> 09:56.920]  So here are you.
[09:57.060 --> 09:58.900]  You're sitting in your living room with a television.
[09:59.160 --> 10:00.880]  And you plug in your Chromecast.
[10:01.460 --> 10:05.240]  And then there's a user up in the upper left-hand corner there.
[10:05.900 --> 10:13.380]  And you are connected out to a wireless using WPA2 and personal mode with a strong unbreakable password.
[10:13.380 --> 10:18.920]  So we're absolutely not talking about like web cracking here or like WPA cracking or anything like that.
[10:19.100 --> 10:26.460]  There was a couple of media organizations who shall remain nameless that like said that this was just a thing about cracking people's wireless passwords.
[10:26.540 --> 10:28.200]  Like hacking into their wireless and then rig rolling.
[10:28.300 --> 10:29.800]  Like that's not absolutely what's happening at all.
[10:30.020 --> 10:31.280]  That would be like super lame.
[10:32.000 --> 10:33.300]  Because of course you can do that, right?
[10:33.520 --> 10:35.200]  But that's like not very interesting.
[10:37.880 --> 10:41.620]  So you connect out to the Internet and then you're streaming some lolcats or I don't know, whatever.
[10:43.880 --> 10:45.760]  So if you want to plug in your Chromecast.
[10:45.800 --> 10:51.500]  If you want to, you know, stream some lolcats to your Chromecast or through your Chromecast to the TV, what do you do?
[10:51.820 --> 10:54.100]  So the Chromecast acts as an access point.
[10:54.160 --> 10:55.280]  This point is really, really important.
[10:55.420 --> 10:56.380]  It's going to come back again later.
[10:56.780 --> 10:59.320]  So the Chromecast actually has its own access point that it throws up.
[10:59.440 --> 11:01.180]  The default like SSID is Chromecast.
[11:01.220 --> 11:03.020]  I think I might have updated it to put like a number at the end.
[11:04.480 --> 11:08.380]  And you connect to it as a client.
[11:08.380 --> 11:14.260]  So your wireless device, maybe like your smartphone or a laptop, has to connect to the access point of the Chromecast itself.
[11:14.640 --> 11:19.620]  And then you go to like chromecast.com slash setup and some JavaScript magic happens.
[11:19.820 --> 11:21.020]  And then you tell it your password.
[11:21.260 --> 11:24.600]  And you like, you connect out to your wireless.
[11:24.740 --> 11:25.980]  Or you use the smartphone app.
[11:26.080 --> 11:27.260]  It's like an official Chromecast app.
[11:27.400 --> 11:28.240]  It'll also do that.
[11:28.600 --> 11:31.220]  So you tell the Chromecast your wireless password.
[11:31.220 --> 11:35.660]  It connects out to your Wi-Fi router.
[11:36.340 --> 11:38.620]  And then you can stream Glowcats to your TV.
[11:40.320 --> 11:43.160]  So the Chromecast security model can best be described as this.
[11:43.440 --> 11:46.240]  It's got this good, crunchy outer shell.
[11:46.440 --> 11:49.060]  And then a soft, gooey, and delicious inside.
[11:49.860 --> 11:52.960]  And the outer shell is your wireless password.
[11:53.140 --> 11:54.400]  It's like your wireless perimeter.
[11:54.980 --> 12:01.100]  Like if you have an open network and anybody can connect to your network, then they can just access your Chromecast and push like any information to it.
[12:02.380 --> 12:09.120]  So like attackers not being able to talk to the Chromecast whatsoever is kind of the security model.
[12:09.620 --> 12:16.300]  So if ever you're able to like communicate to the Chromecast pretty much in any way, then you can push video to it.
[12:17.060 --> 12:22.740]  So the open interior thing is kind of what I was saying that there's no authentication with the Chromecast.
[12:22.840 --> 12:23.500]  There's no authorization.
[12:24.020 --> 12:25.680]  You just push video to it.
[12:25.680 --> 12:28.580]  They make it as absolutely drop-dead easy to stream video to it as possible.
[12:29.120 --> 12:30.260]  Which is totally true.
[12:30.400 --> 12:31.600]  It really is super, super easy.
[12:33.060 --> 12:34.660]  So it's got a secure perimeter here.
[12:34.800 --> 12:39.180]  The like blue area is my best representation of what like a wireless perimeter looks like.
[12:39.620 --> 12:41.380]  So that's kind of like the encrypted zone.
[12:42.560 --> 12:51.660]  So suppose an attacker, my orange device, tries to connect out to the Chromecast, tries to push video to it.
[12:51.780 --> 12:53.920]  It will be thwarted and it kind of bounces away.
[12:53.920 --> 12:58.500]  And that's the best animation that I could figure out to kind of demonstrate that.
[12:58.720 --> 12:59.580]  So there's nothing you do, right?
[12:59.660 --> 13:00.800]  You can't talk to the Chromecast.
[13:00.920 --> 13:04.040]  It's not putting up its wireless access point at this point.
[13:04.380 --> 13:07.120]  Like once the Chromecast has already been configured, it takes down its access point.
[13:07.660 --> 13:11.600]  So now the only way to talk to it is to be on the network of that person's home, right?
[13:11.760 --> 13:13.020]  So there's no way to talk to it.
[13:13.160 --> 13:14.720]  Which means there's no way to push video to it.
[13:17.240 --> 13:19.660]  So there is a possible race condition, right?
[13:19.820 --> 13:24.140]  So we could be talking about maybe when you first set up your Chromecast.
[13:24.260 --> 13:28.360]  You take the thing out of the box, you plug it into the wall, you plug it into your TV.
[13:28.500 --> 13:35.820]  And there's going to be a gap of time between when you like plug in the Chromecast and when you actually set it up, right?
[13:35.820 --> 13:46.980]  So this is a bit of a race condition there where, say, an attacker could come in during that Chromecast SSID period, connect to it, tell it connect back to the attacker, and then out to Rick Astley.
[13:48.100 --> 13:52.780]  The only problem with it... if this attack totally works, the only problem with it is that it's super lame, right?
[13:52.980 --> 13:54.920]  Like this isn't an attack really.
[13:55.160 --> 13:58.820]  Like this isn't a... this is part of the security model of the device.
[13:59.120 --> 14:02.560]  That it has like an SSH-like security model, which I actually don't mind.
[14:02.560 --> 14:05.580]  It has like a one-time insecure setup, right?
[14:05.880 --> 14:07.980]  And then after that, all communications are secure.
[14:08.320 --> 14:12.020]  So the one time that you're going to be insecure, like the one time you're putting out of the box.
[14:12.100 --> 14:14.680]  If your neighbor is right there trying to screw with you, then sure, they can.
[14:15.560 --> 14:18.700]  But like after that, you can be reasonably sure it's okay.
[14:19.560 --> 14:20.680]  So that's fine, actually.
[14:20.780 --> 14:21.380]  I don't think that's bad.
[14:26.290 --> 14:28.110]  If that's actually how it worked, then it would be fine.
[14:30.190 --> 14:31.810]  I mean SSH works that way, right?
[14:31.890 --> 14:34.150]  And nobody really fundamentally complains about SSH.
[14:34.150 --> 14:35.970]  So I think that overall it works.
[14:35.990 --> 14:39.390]  Especially for a device that honestly like isn't, you know, a web server.
[14:39.510 --> 14:42.710]  This isn't, you know, containing like critically sensitive information.
[14:42.950 --> 14:45.330]  So this is a perfectly fine security model.
[14:46.290 --> 14:46.750]  All right.
[14:46.950 --> 14:48.250]  So I thought about that for a while.
[14:48.370 --> 14:51.850]  I kind of almost gave up after I don't know how long.
[14:51.910 --> 14:55.130]  Maybe like a month of kind of trying to mess with the Chromecast.
[14:55.310 --> 14:58.110]  And I just kind of took a peek at their official FAQ online.
[14:58.310 --> 14:59.210]  And it has this question.
[14:59.270 --> 15:01.570]  This is one of the only things I'm going to read verbatim off the slides.
[15:01.570 --> 15:02.390]  Is the question.
[15:02.690 --> 15:06.490]  Can I take the Chromecast with me to use when I travel?
[15:06.950 --> 15:07.290]  Okay.
[15:07.570 --> 15:08.570]  The answer is yes.
[15:08.870 --> 15:11.010]  The Chromecast was built with portability in mind.
[15:11.270 --> 15:12.710]  You can bring it with you when you travel.
[15:12.850 --> 15:16.290]  But keep in mind that you will need Wi-Fi access to set up and use the Chromecast.
[15:16.930 --> 15:18.850]  So I thought, well that's...
[15:18.850 --> 15:20.030]  Wait now, right?
[15:20.190 --> 15:27.350]  Because if the Chromecast is connected to your home wireless network, that means when you're on vacation, you're going to have to set it up all again, right?
[15:27.350 --> 15:28.750]  So imagine the following scenario.
[15:28.890 --> 15:30.510]  You're on vacation in Maui, right?
[15:30.930 --> 15:33.250]  You pull the Chromecast out of your luggage, right?
[15:33.350 --> 15:34.790]  After a long day at the beach or whatever.
[15:35.050 --> 15:37.990]  You put it into the side of the hotel TV room, right?
[15:38.770 --> 15:40.890]  And you want to connect it to the hotel's wireless.
[15:41.650 --> 15:45.650]  And so you have to re-instruct the Chromecast to say what new S site it can connect to.
[15:45.730 --> 15:47.010]  And maybe even a new password, right?
[15:47.010 --> 15:54.550]  So it's one time insecure set up network is going to have to get established for you to be able to do that.
[15:54.890 --> 15:56.990]  So how does the Chromecast know when you're on vacation?
[15:58.270 --> 16:01.510]  I'm using the very dramatic contrast slide to demonstrate this.
[16:03.050 --> 16:08.770]  So when you're trying to get to the hotel's wireless, it knows that you're on vacation when it can't connect to your home Wi-Fi.
[16:10.790 --> 16:11.250]  Right?
[16:11.370 --> 16:12.950]  So the gears start turning at this point.
[16:12.950 --> 16:13.550]  You're like, oh.
[16:14.150 --> 16:16.710]  So it tries to connect out to your home Wi-Fi.
[16:16.950 --> 16:20.890]  If it fails, then it puts up this one time insecure set up network.
[16:21.910 --> 16:23.410]  So it kind of looks like this, right?
[16:23.770 --> 16:26.770]  So on vacation, you plug in your Chromecast.
[16:27.190 --> 16:28.110]  And it goes...
[16:28.110 --> 16:28.890]  I love this animation.
[16:30.290 --> 16:31.590]  It's been way too long on that.
[16:32.710 --> 16:34.530]  So it goes, where is my home network?
[16:34.650 --> 16:35.310]  I don't see it.
[16:35.570 --> 16:35.650]  Right?
[16:35.770 --> 16:38.410]  Spends a couple of seconds and then says, well, I must be on vacation.
[16:40.130 --> 16:42.710]  And it puts up the insecure network.
[16:42.930 --> 16:43.870]  The SSI...
[16:43.870 --> 16:44.630]  That's open network.
[16:44.830 --> 16:46.130]  That's SSID of Chromecast.
[16:47.650 --> 16:49.170]  And then the user can connect to it.
[16:49.350 --> 16:51.050]  And then connect to lolcats or whatever.
[16:51.510 --> 16:52.350]  So I can force...
[16:52.350 --> 16:53.730]  This is a hilarious clip art.
[16:53.790 --> 16:54.530]  I could not use it.
[16:56.590 --> 16:58.470]  I've got lots of really corny clip art in here.
[16:58.570 --> 16:58.790]  It's great.
[16:59.450 --> 17:02.410]  So you can make people take a forced vacation maybe if you want.
[17:02.510 --> 17:02.570]  Right?
[17:02.950 --> 17:07.850]  So if you're not familiar with Wi-Fi as a protocol, there's this thing called the de-authentication attack.
[17:08.390 --> 17:11.970]  So de-authentication packets in Wi-Fi are always unencrypted.
[17:12.090 --> 17:14.030]  So even on like WPA2, PSK.
[17:14.970 --> 17:16.550]  Even on encrypted networks.
[17:17.030 --> 17:20.050]  De-authentication packets are always in plain text.
[17:20.270 --> 17:21.290]  And it kind of has...
[17:21.290 --> 17:23.070]  It sort of sounds like a vulnerability maybe by itself.
[17:23.170 --> 17:24.250]  But it kind of has to be that way.
[17:24.630 --> 17:27.790]  Because access points have to have a way of telling clients to shut up.
[17:28.070 --> 17:30.330]  To like disassociate for whatever reason.
[17:30.670 --> 17:33.310]  Like maybe they got confused and they're in a half connected state.
[17:33.310 --> 17:35.210]  And so you can't send them an encrypted message.
[17:35.330 --> 17:36.750]  You can't have to send them an unencrypted message.
[17:37.350 --> 17:38.950]  So that means that anybody can spoof them.
[17:39.450 --> 17:42.550]  So anybody can just pretend to be the wireless access point.
[17:42.690 --> 17:46.850]  And kick off what client that, you know, should be otherwise normally connected.
[17:48.170 --> 17:52.830]  So that's what one of the tools in Aircrack or the Airreplay has a specific mode for this.
[17:52.930 --> 17:57.230]  So you can spoof de-authentication packets as anybody to anybody.
[17:57.530 --> 17:59.010]  Essentially this is a denial of service attack.
[17:59.110 --> 18:00.490]  It's been well known for years and years and years.
[18:01.090 --> 18:03.370]  And there's not really anything that anybody can do about it.
[18:03.710 --> 18:06.930]  And normally it's not considered a big deal because it's just a denial of service attack.
[18:07.290 --> 18:10.790]  And if you really wanted to, you didn't have to do de-authentication.
[18:10.970 --> 18:16.050]  Like if you wanted to DOS somebody and you're over Wi-Fi, you could just like flood the RF spectrum or something like that.
[18:16.510 --> 18:18.330]  So it's not considered that great of a deal.
[18:18.710 --> 18:21.730]  Except in this case, it leads to some awesome consequences.
[18:22.670 --> 18:26.270]  So the attack has a kind of end-to-end almost.
[18:27.070 --> 18:29.430]  As you have a home wireless situation just like we had before.
[18:29.690 --> 18:30.650]  So it's secured.
[18:30.790 --> 18:32.630]  It's got an unbreakable password that we're not going to crack.
[18:33.350 --> 18:36.090]  The Chromecast is connected to it and they're happily streaming HBO.
[18:36.290 --> 18:37.270]  They're looking at some Game of Thrones.
[18:38.430 --> 18:44.870]  And then Rickmote comes by, sends out a de-authentication message to the Chromecast, right?
[18:45.650 --> 18:48.350]  So then the Chromecast says, all right, I better disconnect.
[18:49.230 --> 18:51.050]  So it closes out.
[18:51.550 --> 18:52.150]  Then it...
[18:52.630 --> 18:56.490]  Now it says, well, I'm not connected to my home network anymore, so I must be on vacation.
[18:57.210 --> 19:02.370]  Throws up its one-time insecure setup network, the SSID of Chromecast.
[19:03.590 --> 19:06.650]  And then we can connect to it and stream some Rickroll.
[19:08.810 --> 19:12.310]  So that's more or less how the attack goes from end-to-end.
[19:12.310 --> 19:15.510]  Though there's a lot of details in here that I'm going to try to cover still.
[19:22.360 --> 19:22.800]  All right.
[19:22.940 --> 19:25.740]  So fumbling with wires, however, isn't very interesting.
[19:25.940 --> 19:27.500]  Like you could do all this manually.
[19:27.740 --> 19:28.940]  Like that's pretty much it.
[19:29.020 --> 19:30.760]  The gist of it is that de-authentication attack.
[19:30.960 --> 19:35.280]  Like once you kick off the Chromecast from its network, it puts up its one-time insecure network.
[19:35.400 --> 19:36.100]  And then it's open.
[19:36.320 --> 19:36.640]  You just...
[19:36.640 --> 19:38.020]  Everything theoretically is there.
[19:38.180 --> 19:40.360]  Like once you can talk to the Chromecast, all bets are off.
[19:40.540 --> 19:42.840]  You can now stream information to it.
[19:43.940 --> 19:46.840]  Everything else past that is kind of just like a task of engineering.
[19:47.100 --> 19:48.680]  Like how do you actually push video to it?
[19:48.760 --> 19:49.800]  Like how do you actually connect to it?
[19:49.900 --> 19:51.020]  Like what IP addresses are running?
[19:51.100 --> 19:52.340]  What services are the stupid thing running?
[19:52.520 --> 19:54.740]  And there's like no good information about this on the Internet.
[19:55.040 --> 19:57.040]  So hopefully this will be informative for that.
[19:57.420 --> 20:01.340]  And almost all of this or all of this is automated inside of the actual tool that I made for it.
[20:03.160 --> 20:05.720]  So yeah, little details are available online.
[20:05.920 --> 20:06.740]  Some reverse engineering.
[20:07.420 --> 20:08.580]  So here's some information.
[20:09.840 --> 20:10.120]  The...
[20:10.120 --> 20:11.940]  So yeah, the Chromecast is open Wi-Fi.
[20:12.020 --> 20:12.920]  No authentication or encryption.
[20:13.000 --> 20:13.740]  So you just connect to it.
[20:14.700 --> 20:18.020]  The Chromecast is running that very particular IP address.
[20:18.520 --> 20:22.560]  And it's running essentially a web server on port 8008.
[20:22.800 --> 20:24.260]  It has really two...
[20:24.260 --> 20:27.400]  It's got four kind of interesting web services that are available on it.
[20:27.580 --> 20:28.620]  Two of them are very interesting.
[20:29.080 --> 20:31.920]  So there's Eureka Info, which we'll get into in a moment.
[20:32.160 --> 20:34.800]  There's Scan Wi-Fi, which will kind of do what it sounds like.
[20:34.900 --> 20:38.140]  It scans the local area for what wireless networks are around.
[20:38.280 --> 20:39.600]  And then you can view the results of them.
[20:39.740 --> 20:42.560]  And give it to you like in a nice JSON encoded form.
[20:42.780 --> 20:44.720]  And then Connect Wi-Fi, which we'll get into.
[20:47.220 --> 20:49.300]  So Eureka Info, there's no way you're going to read that.
[20:49.540 --> 20:50.340]  So don't even bother.
[20:50.840 --> 20:53.620]  It gives you all kinds of information about the Chromecast itself.
[20:53.780 --> 20:59.120]  So it just kind of dumps all of the data that's like identifiable or interesting about that particular Chromecast.
[20:59.260 --> 21:02.720]  So it tells you what like version of Chromecast software it's running.
[21:02.880 --> 21:03.960]  It tells you the friendly name.
[21:04.040 --> 21:05.640]  So each Chromecast has a friendly name.
[21:06.000 --> 21:07.060]  Like the name that you give it.
[21:07.140 --> 21:09.140]  You can say like Pete's Chromecast or something like that.
[21:09.340 --> 21:11.460]  And then that'll be like the Chromecast's name.
[21:11.520 --> 21:14.120]  That's also, by the way, the SSID of the Chromecast when you put it up.
[21:15.540 --> 21:16.740]  So it also has a public key.
[21:16.740 --> 21:19.640]  So it's got like an RSA, I assume it's RSA, public key.
[21:19.940 --> 21:22.740]  And so it'll spit out the public key out at you.
[21:22.880 --> 21:28.040]  And then it's later used to encrypt Wi-Fi credentials.
[21:28.300 --> 21:40.400]  So when you tell it to connect to your home wireless network, and you have like that, your web key or your WPA key, it encrypts the contents of that password with the public key here.
[21:40.400 --> 21:46.200]  So it's, I mean, you could still man-in-the-middle and the public key and replace it with an attacker public key or whatever, right?
[21:46.300 --> 21:49.300]  It's not like completely end-to-end secure, but it's not so bad.
[21:51.940 --> 21:52.940]  Yeah, I already said the other thing.
[21:53.100 --> 21:54.900]  So that's really good.
[21:54.980 --> 21:58.020]  It's also really, really useful for verifying that you're on a Chromecast network.
[21:58.360 --> 22:04.780]  One of the initial troubles that I had was that so you connect to like an open network, but how do you know that it's a Chromecast network, right?
[22:05.100 --> 22:08.820]  Like maybe the SSID will say cast in it or something like that.
[22:08.820 --> 22:10.120]  But how do you really know, right?
[22:10.760 --> 22:18.620]  So the best way is to connect to this very specific IP address and see if it gives you a web service response for Eureka info or slash setups slash Eureka info.
[22:19.080 --> 22:20.120]  Great way to determine it.
[22:20.800 --> 22:23.680]  So that's the first thing we do once we connect out to a Chromecast network.
[22:24.200 --> 22:25.240]  So swapping connections.
[22:25.840 --> 22:28.900]  So now we are connected to the Chromecast.
[22:28.980 --> 22:31.760]  So we are the client connected to the Chromecast, which is an access point.
[22:32.300 --> 22:34.640]  So the next thing we want to do is tell it to connect back to us.
[22:34.720 --> 22:36.840]  So we're going to throw up our own access point, right?
[22:36.840 --> 22:38.440]  That is now the attacker's access point.
[22:38.820 --> 22:41.320]  And we are going to tell the Chromecast to connect back to us.
[22:42.020 --> 22:47.240]  So you just post that has four or five pieces of information.
[22:48.920 --> 22:51.880]  The WPA keys are encrypted using that password.
[22:51.940 --> 23:03.880]  So if you want to have like a secure connection for yourself, you don't want people like connecting to your Internet connection that you're using to Rickroll people to come back and go to the Internet, then you'd probably want to put a Wi-Fi password on that.
[23:04.500 --> 23:07.360]  So you have to encrypt it with a public key and send it out.
[23:07.500 --> 23:07.960]  It's a big hassle.
[23:10.160 --> 23:11.500]  Or you could just send it...
[23:11.500 --> 23:12.700]  You have an unencrypted network.
[23:12.820 --> 23:13.540]  That's much easier anyway.
[23:13.680 --> 23:16.740]  So you have to tell it the BSSID and the SSID.
[23:16.900 --> 23:19.800]  Those are the two important pieces of information on this post.
[23:21.700 --> 23:22.060]  Okay.
[23:22.240 --> 23:24.200]  So now the Chromecast is connected to our network.
[23:24.200 --> 23:30.760]  So we have the Chromecast connected to us, and we have it DHCPs as soon as it connects out to our network.
[23:31.000 --> 23:33.960]  And then we just kind of have a problem of figuring out where it is, right?
[23:34.300 --> 23:39.060]  Like maybe we can be monitoring our DHCP connections, but I don't know, maybe somebody else connected at the same time.
[23:39.540 --> 23:43.340]  Like there's not a very good way of just like kind of a priori discovering Chromecast.
[23:44.320 --> 23:46.740]  So they've already... obviously Google already solved this problem.
[23:46.860 --> 23:52.380]  So they invented this protocol called DIAL, which is that it's discovery and lookup that DI is like discovery.
[23:52.380 --> 23:53.920]  It's a silly acronym.
[23:55.500 --> 23:57.740]  So it's pretty much SSDP.
[23:58.060 --> 24:00.380]  If you want to look that up, it's UDP on port 1900.
[24:01.760 --> 24:05.360]  The contents of it looks like it might be HTTP, but it's not.
[24:05.540 --> 24:07.840]  Like it has HTTP headers and it has a body.
[24:08.020 --> 24:12.200]  I totally thought it was HTTP for a long while looking at it until just...
[24:12.200 --> 24:15.080]  It was very obviously not because it's UDP.
[24:15.740 --> 24:19.620]  And also it's going out to like a multicast address and all the rest of the HTTP stuff doesn't apply.
[24:20.340 --> 24:28.220]  So you just send out a packet that has some specific headers that are easily found because it's pretty standard SSDP.
[24:29.260 --> 24:36.000]  To this multicast address and Chromecasts, all of them will respond back and say, hey, I'm a Chromecast, here's my name, like here's my IP address, etc.
[24:36.740 --> 24:40.460]  So that's an easy way of figuring out what Chromecasts are available on your network.
[24:42.220 --> 24:45.060]  And that's what all the apps do to them.
[24:45.760 --> 24:50.980]  So Chromecast apps, shout out to anybody who gets the joke on the upper right-hand corner.
[24:51.840 --> 24:53.680]  So there's two halves to any app.
[24:53.820 --> 24:54.920]  There's a client and a server.
[24:55.280 --> 24:59.800]  So the server end is the stuff that's running on the Chromecast itself.
[25:00.500 --> 25:07.240]  So apps like YouTube, apps like HBO Go, things like that are actually on the Chromecast itself.
[25:07.240 --> 25:10.100]  So there's an entire process for getting that set up, obviously.
[25:10.320 --> 25:12.480]  You have to submit your code to Google and they have to review it.
[25:12.540 --> 25:13.440]  I assume they review it.
[25:14.520 --> 25:17.520]  And then they have to whitelist it and there's code signing involved.
[25:17.640 --> 25:28.840]  There's actually a huge lockdown that Google spends a lot of time and effort making sure that malware doesn't get pushed to the Chromecast itself and only they manage what apps get put onto Chromecast because they get broadcast to everybody.
[25:29.080 --> 25:35.220]  So even if you don't have HBO Go, you have an HBO Go app on your Chromecast at all times.
[25:38.000 --> 25:44.440]  And all those go under the web directory of slash apps slash whatever the app name is.
[25:44.900 --> 25:51.860]  And then the client application is the thing that's actually on your phone or if it's a web application on your web or desktop or whatever.
[25:52.500 --> 25:57.700]  So we can probably bypass these for a lot of the more simple ones.
[25:57.840 --> 25:59.880]  Like YouTube, for instance, is really, really simple.
[25:59.960 --> 26:01.360]  We don't even need a client application.
[26:01.500 --> 26:02.920]  You don't need to go into the YouTube app.
[26:03.480 --> 26:14.240]  Since one of the troubles of trying to automate all this is that there's official SDKs out for the Chromecast, of course, but they only exist for Android apps and for like Chromium or Chrome tabs.
[26:14.940 --> 26:18.240]  And in order to automate this properly, I just wanted to do it in Python.
[26:18.400 --> 26:20.080]  I just wanted a Python script to do this.
[26:20.160 --> 26:26.740]  I didn't want to make an Android app that used the official SDK because we need to do a lot of underlying things that aren't technically allowed.
[26:29.860 --> 26:32.020]  So YouTube is super simple.
[26:32.160 --> 26:37.940]  You just make a post using regular form encoding to the app slash YouTube.
[26:38.540 --> 26:41.800]  And it has three pieces of information there.
[26:42.020 --> 26:43.820]  Only one of them is really interesting.
[26:44.060 --> 26:47.740]  The one in the middle there is the Rickroll end.
[26:48.240 --> 26:50.620]  So if you go to youtube.com slash...
[26:51.340 --> 26:53.580]  Yeah, youtube.com slash like...
[26:53.580 --> 26:54.900]  V equals that?
[26:55.020 --> 26:55.440]  I think it's V.
[26:55.560 --> 26:55.780]  Whatever.
[26:56.500 --> 26:58.560]  That's the suffix at the end of the YouTube link, right?
[26:58.660 --> 27:00.620]  That specifies what YouTube video you want to play.
[27:01.180 --> 27:08.960]  And there's other interesting posts you can make out to the YouTube app, like stop and start and replay and queue and things like that.
[27:08.960 --> 27:11.160]  Or things like turn up volume.
[27:13.600 --> 27:19.660]  The pairing code just tells the YouTube what number you are as a client.
[27:19.780 --> 27:20.980]  So you can literally put whatever in there.
[27:21.120 --> 27:22.260]  And I have no idea what T is.
[27:24.040 --> 27:28.720]  So one of the other interesting consequences of the Chromecast is what you might call the long play.
[27:29.400 --> 27:34.020]  Like if your literal neighbor, like your actual neighbor, like somebody nearby you has a Chromecast, right?
[27:34.200 --> 27:37.980]  And you connect it back to your home network, like your home network never goes away.
[27:39.660 --> 27:42.260]  And so it just connects to it like forever.
[27:43.700 --> 27:46.720]  And the Chromecast, like there's no way of turning it off really.
[27:46.800 --> 27:50.780]  Like even if the person were to unplug it and plug it back in, it's your the home network.
[27:50.960 --> 27:52.700]  This is going to come back to your home network.
[27:52.860 --> 27:55.100]  Like they're going to have to like do a factory reset on the thing.
[27:55.180 --> 27:58.820]  And if they don't know what a factory reset is, then it's just your Chromecast now.
[28:01.820 --> 28:04.940]  So yeah, non-technical users, like this is a pretty bad thing.
[28:08.450 --> 28:21.600]  So some features that are, if you go online and like look at the code that I have out for the current Rickmote, some features that I don't have implemented yet that are going to be coming as soon as I can get them, is that the current version actually uses YouTube to play Rickroll,
[28:21.780 --> 28:24.660]  which means you have to have a working Internet connection, which kind of sucks, right?
[28:24.960 --> 28:29.420]  So you have to like tether from your phone or like connect out to a Wi-Fi that has it and bridge the connection.
[28:29.420 --> 28:31.300]  So you can do local streaming.
[28:31.400 --> 28:32.980]  The Chromecast already has like support for that.
[28:34.040 --> 28:37.720]  But it's like the Plex Media Center or something like that, which isn't totally open-source.
[28:38.040 --> 28:42.540]  And then the VLC is supposedly adding support soon, but that hasn't quite come out yet.
[28:42.880 --> 28:44.180]  So that's stuff I'm working on.
[28:45.320 --> 28:46.020]  Wi-Fi next.
[28:46.140 --> 28:51.240]  So it actually has to have three like hardware wireless devices, because you need in fact three wireless devices.
[28:51.660 --> 28:55.060]  You need to have monitor mode, which does the de-authentication attack.
[28:55.360 --> 28:57.520]  You need to have a managed mode to connect to the Chromecast.
[28:57.520 --> 29:00.380]  And you need to have a master mode to have an access point.
[29:00.540 --> 29:02.600]  But maybe you don't need all three all at the same time.
[29:02.820 --> 29:03.020]  I don't know.
[29:03.120 --> 29:06.300]  So there's some engineering work to be done there.
[29:07.720 --> 29:12.380]  There's the general rudeness of it all, which is that the current version just literally de-auths everything.
[29:15.000 --> 29:15.960]  So there's that.
[29:17.220 --> 29:20.000]  Also, the Chromecast is pretty good at reconnecting pretty quickly.
[29:20.360 --> 29:22.880]  So like within about 10 seconds, it reconnects back to its network.
[29:23.040 --> 29:28.380]  So in order to keep it down long enough for the attack to happen, you just have to keep on de-authenticating it over and over and over again.
[29:28.580 --> 29:30.000]  And so you can't just like smack it.
[29:30.060 --> 29:34.420]  You have to like take the pillow and like smother it in its face, just hold it down for a while.
[29:34.840 --> 29:36.880]  But we have to do that to every network in the area.
[29:36.980 --> 29:42.680]  So I'm sure there's a way of doing better identification so we don't have to like bother literally every device in wireless range.
[29:43.960 --> 29:46.880]  And then there's the, oh yeah, identifying Chromecast networks.
[29:47.100 --> 29:57.720]  The Chromecast app, like if you go into your like Android app and say like what Chromecasts are around, it just like instantly knows what Chromecasts are around if there's access, if they're running their own access points.
[29:58.210 --> 29:59.420]  It's just like super fast.
[29:59.540 --> 30:06.440]  Like the way that like I'm doing this to actually connect to the thing as a client and then do an HTTP, like to DHCP, and then you have to like wait for an HTTP get to come back.
[30:06.620 --> 30:07.940]  It's like take some time.
[30:08.960 --> 30:10.840]  Whereas like the app is clearly doing something different.
[30:10.840 --> 30:20.800]  I don't, I think it might be MAC address looking at, like the prefixes to the MAC addresses might be enumerable and it knows all the ones that are responsible for Chromecasts.
[30:21.060 --> 30:24.520]  I tried doing that but I didn't find any discernible pattern, but maybe that's the case.
[30:24.960 --> 30:25.960]  So we have to figure that out.
[30:26.040 --> 30:27.600]  That would make identification a lot faster.
[30:29.860 --> 30:30.860]  And so remediation.
[30:31.040 --> 30:35.940]  So this is, this came up earlier and this always comes up like, so what can Google do to fix it?
[30:35.960 --> 30:41.920]  I actually had months ago, disclosed this to Google like in their official like bug forms.
[30:42.260 --> 30:43.660]  And they marked it as won't fix.
[30:44.620 --> 30:49.920]  Essentially saying that like they, they didn't consider it a very big deal one, which I don't want to comment on.
[30:50.020 --> 30:56.140]  And then there's that, like there's not a really good way to fix it without implementing, without impacting usability.
[30:57.020 --> 31:01.300]  So there's a couple of options here that I'm going to suggest, but maybe not any good options.
[31:01.620 --> 31:04.700]  So when you set up the Chromecast, if you have one, you know, you know this.
[31:04.700 --> 31:08.440]  Like it pops up with this little four digit code, but they're not, like two of them are letters, but whatever.
[31:09.440 --> 31:11.060]  And it's not actually used for security.
[31:11.700 --> 31:16.380]  It's just there, like it tells you, if you look at your app, it'll say, hey, is this your code?
[31:16.480 --> 31:17.700]  And it'll say like Z4Y4.
[31:18.480 --> 31:19.980]  And you can just say yes, right?
[31:20.060 --> 31:21.600]  So it's not actually like a security code.
[31:21.680 --> 31:25.120]  It's not a thing to keep you from attacking other people's Chromecast.
[31:25.200 --> 31:27.780]  It's just there to make sure you didn't accidentally connect to somebody else's machine.
[31:29.160 --> 31:32.240]  So maybe you have the user like enter in that code.
[31:32.240 --> 31:38.420]  That way they'd have to actually look at the screen in order to like use the Chromecast that's responsible for it.
[31:39.520 --> 31:40.640]  And that's okay, actually.
[31:40.820 --> 31:41.620]  It's not so bad.
[31:42.340 --> 31:44.200]  But short codes are going to be brute forceable, right?
[31:44.280 --> 31:45.840]  That's going to be available via some web service.
[31:45.920 --> 31:46.940]  And I could just spam every code.
[31:47.100 --> 31:49.480]  And like if it's four digits, it happened in like a second.
[31:49.600 --> 31:50.480]  That would be so fast, right?
[31:50.800 --> 31:51.440]  It would be no big deal.
[31:51.640 --> 31:53.420]  So you'd have to have like longer codes.
[31:53.540 --> 31:54.780]  You're going to have timeouts or something.
[31:55.300 --> 31:57.880]  But even a short code is probably a non-starter.
[31:58.220 --> 32:01.460]  Like even a short code, like people are going to fumble over and they're going to complain about.
[32:01.660 --> 32:02.700]  And it's going to be a huge deal.
[32:03.280 --> 32:06.020]  And they're like, it's not, it's probably not going to work.
[32:06.620 --> 32:10.100]  Because the device is just made intentionally to be brain dead easy to use.
[32:11.640 --> 32:14.060]  So it could require physical device interactions.
[32:14.320 --> 32:21.980]  So like before throwing up its one-time access or access point, maybe you have to press the one button that's on the thing, right?
[32:22.520 --> 32:25.080]  But like for one, that's going to be a big pain.
[32:25.080 --> 32:30.020]  And then also like what if you have it like in the back of your TV in a way that's like high up and you can't reach the thing.
[32:30.360 --> 32:31.860]  People are going to be complaining about that, right?
[32:32.540 --> 32:33.820]  Or what about button malfunction?
[32:34.060 --> 32:34.740]  This is a real thing.
[32:35.160 --> 32:38.280]  Like the first like bunch of iterations of it, like the button just didn't work.
[32:39.020 --> 32:41.320]  Like it wouldn't, it wouldn't press down for whatever reason.
[32:41.600 --> 32:43.100]  So all those people would be kind of screwed.
[32:45.740 --> 32:47.340]  Then maybe config only and boot up.
[32:47.420 --> 32:48.680]  So you have to actually power cycle the thing.
[32:48.800 --> 32:50.900]  But that kind of has the same problem as the other one.
[32:51.020 --> 32:53.280]  But even worse because now you have to unplug it and then re-plug it in.
[32:54.080 --> 32:55.340]  And it's really unintuitive too.
[32:55.420 --> 32:56.300]  What other device does that?
[32:56.580 --> 32:59.140]  Like what other device in your house like do you have to reboot to configure?
[32:59.320 --> 33:00.080]  Like it doesn't make any sense.
[33:00.580 --> 33:01.540]  Nobody would know to do that.
[33:01.660 --> 33:02.760]  Everybody would have to look it up online.
[33:05.140 --> 33:07.620]  Well, you wouldn't just start screwing.
[33:07.660 --> 33:08.480]  I mean we do it anyway.
[33:08.640 --> 33:09.600]  You don't have to strictly speaking.
[33:09.760 --> 33:13.380]  I mean turning it off and on again is the first thing you try when it doesn't work.
[33:13.640 --> 33:14.440]  For us, right?
[33:14.580 --> 33:14.980]  But we have to...
[33:14.980 --> 33:17.020]  How many times have you had to tell your parents to do that, right?
[33:17.920 --> 33:19.240]  Because they don't know to do that.
[33:19.400 --> 33:20.540]  So nobody would know to do this.
[33:23.640 --> 33:27.800]  There's also this which I considered which is to ignore de-authentication packets.
[33:29.440 --> 33:30.820]  Which would be interesting.
[33:31.320 --> 33:33.860]  But I'm not sure that would actually like work well with Wi-Fi.
[33:34.060 --> 33:38.460]  I'm not actually knowledgeable enough about the low level details of Wi-Fi.
[33:38.600 --> 33:40.420]  Whether that would totally screw everything up.
[33:40.940 --> 33:45.200]  Like if you powered down like your wireless router, would it like not know to disconnect?
[33:45.680 --> 33:47.400]  Or like is that an integral part?
[33:47.500 --> 33:47.780]  I don't know.
[33:47.980 --> 33:50.740]  That might just totally screw up Wi-Fi to the point where you can't do it.
[33:51.120 --> 33:52.780]  Plus it doesn't really fix anything, right?
[33:52.840 --> 33:56.460]  This is just one way of doing a denial of service attack.
[33:56.660 --> 33:57.540]  There's plenty of others.
[33:58.100 --> 34:00.980]  For instance, like if the Chromecast can't connect out to the Internet.
[34:01.220 --> 34:03.920]  Then it also throws up the Wi-Fi thing.
[34:04.360 --> 34:09.020]  So like if you were to physically like snip your like neighbor's like cable line, that would work too.
[34:09.220 --> 34:10.600]  Would not suggest that though.
[34:12.190 --> 34:15.720]  Or you just flood the 2.4 gigahertz spectrum, which is probably illegal.
[34:15.910 --> 34:16.480]  But whatever, right?
[34:23.830 --> 34:24.730]  That was really loud.
[34:27.820 --> 34:28.300]  All right.
[34:28.580 --> 34:29.060]  That's it.
[34:29.240 --> 34:30.860]  I have time for questions hopefully.
[34:31.220 --> 34:31.380]  Cool.
[34:40.400 --> 34:41.340]  Yeah, that's the whole video.
[34:41.460 --> 34:45.500]  Oh, so I think we have a microphone over here would be the best way to ask some questions.
[34:46.540 --> 34:47.600]  I'll turn this down a little bit.
[34:48.460 --> 34:49.480]  This was pretty cool.
[34:50.520 --> 34:50.880]  Thanks.
[34:54.780 --> 35:04.540]  So, as I understand, the dial specification actually lives on in a white paper that is freely available for download for anybody who goes and looks for it, right?
[35:04.600 --> 35:05.280]  That is correct, yeah.
[35:05.380 --> 35:07.760]  It's like dial-multiscreen.org, I think.
[35:08.460 --> 35:13.500]  Are there any other fun applications that happen to be installed on Chromecast by default besides YouTube?
[35:14.200 --> 35:16.300]  Yeah, there's actually a list you can get.
[35:16.480 --> 35:19.840]  There's a URL that I can't recall.
[35:19.960 --> 35:22.280]  I wouldn't be able to tell it to you if I knew the URL anyway.
[35:22.480 --> 35:23.420]  But you can look that up.
[35:23.480 --> 35:27.520]  Yeah, there's an entire list of applications that are installed on the Chromecast by default.
[35:27.980 --> 35:30.120]  So there's not any custom things.
[35:30.800 --> 35:32.040]  All Chromecasts are all the same.
[35:32.640 --> 35:37.400]  So it doesn't depend on what you, as a user, have in terms of services.
[35:37.400 --> 35:41.700]  So it doesn't care whether you don't have an HBO subscription, you're gonna have the HBO Go app.
[35:42.260 --> 35:42.620]  Okay.
[35:42.640 --> 35:43.520]  So they all have the same thing.
[35:43.920 --> 35:44.540]  Thank you so much.
[35:44.660 --> 35:44.980]  Yeah, you bet.
[35:46.420 --> 35:47.600]  For the record, there's all...
[35:47.600 --> 35:54.660]  There's, as an addendum, there's three outfits that Rick wears in the Rick Astley video.
[35:55.000 --> 36:00.160]  So there's this, which is the suit jacket, striped shirt, and horrible pants.
[36:02.220 --> 36:02.620]  There's...
[36:06.570 --> 36:06.970]  There's...
[36:06.970 --> 36:09.550]  I had a hard time deciding which one to go with.
[36:10.370 --> 36:13.730]  There's full denim and sunglasses, which you might see.
[36:13.870 --> 36:15.910]  And then there's trench coat and black undergarments.
[36:18.110 --> 36:20.470]  A funky bartender is the best part about this whole video.
[36:21.210 --> 36:23.290]  But there's full denim, sunglasses.
[36:23.530 --> 36:28.030]  I've actually almost went with full denim, sunglasses, but I figured nobody would recognize it, and I would just look like an idiot.
[36:30.050 --> 36:30.450]  Yeah.
[36:30.850 --> 36:32.010]  So hopefully this worked out.
[36:32.010 --> 36:32.710]  I'm sorry.
[36:32.850 --> 36:32.990]  Go ahead.
[36:32.990 --> 36:33.970]  That's a pretty sweet look, though.
[36:35.810 --> 36:37.830]  I've got a question about smart TVs.
[36:38.190 --> 36:38.350]  Yeah.
[36:38.490 --> 36:39.690]  Have you looked at that at all?
[36:40.190 --> 36:53.210]  I mean, you know, because I had in the Crowcast school, but, you know, like probably like a lot of other people have played with this thing, you plug it in, and then you kind of stop using that input on your TV.
[36:53.490 --> 36:54.290]  And, you know, like...
[36:54.290 --> 37:02.450]  So another question I would have, is there any way to force the Comcast to use, I think it's called the CEC channel, to actually change inputs on your TV?
[37:02.930 --> 37:03.350]  Excellent question.
[37:03.510 --> 37:04.310]  So I don't have support...
[37:04.310 --> 37:06.230]  I'm going to go backwards in answering that.
[37:06.330 --> 37:07.270]  So I don't have...
[37:07.270 --> 37:07.530]  Sorry.
[37:07.570 --> 37:08.190]  Flip guy.
[37:08.690 --> 37:08.810]  All right.
[37:08.930 --> 37:09.370]  So the...
[37:09.370 --> 37:10.370]  I'm getting really distracted.
[37:10.710 --> 37:11.250]  Let me close this.
[37:11.950 --> 37:12.750]  So the...
[37:12.750 --> 37:13.090]  Oh, yeah.
[37:13.370 --> 37:13.770]  CEC...
[37:13.770 --> 37:13.870]  Oh, yeah.
[37:13.950 --> 37:14.530]  HDMI CEC support.
[37:14.610 --> 37:16.450]  So the Chromecast has HDMI CEC support.
[37:16.630 --> 37:23.730]  So if you're not familiar with CEC, I don't remember what it stands for, but it's a way of HDMI devices to push settings to the television.
[37:24.250 --> 37:28.990]  Things like turning the television on, and turning it to the right input, and then turning up the volume.
[37:29.710 --> 37:33.310]  So this could be like the rig roll that you can't actually turn your own TV off for.
[37:35.150 --> 37:38.730]  I didn't do that yet, but yeah, expect that to be coming.
[37:39.270 --> 37:41.370]  And then, oh yeah, going back about other smart TVs.
[37:41.990 --> 37:44.970]  I imagine other devices work similarly to the Chromecast, right?
[37:45.690 --> 37:48.930]  Devices which don't have any like hardware input, like a smart TV.
[37:49.290 --> 37:57.110]  I haven't looked into them like specifically yet, and they might not have the exact same functionality, but they're going to work in a similar way.
[37:57.250 --> 38:02.010]  Since you can't, like interface, you can't type in your password to them, you can only talk to it over Wi-Fi.
[38:02.550 --> 38:06.670]  So the easiest way is maybe it to throw its own Wi-Fi up, and then it might have the entire same set of problems.
[38:07.050 --> 38:08.590]  Oh, before I forget, I actually have the...
[38:08.590 --> 38:09.470]  I almost forgot to do this.
[38:09.590 --> 38:12.210]  I have the Rickmode controller right here in front of me.
[38:12.610 --> 38:15.030]  It's not actually hooked up to anything, so I'm not going to be Rickrolling anybody.
[38:15.570 --> 38:20.110]  But yeah, so it's a Raspberry Pi with this like slick 3D printed case around it.
[38:20.570 --> 38:21.630]  Shoutouts to Fran if you're watching.
[38:23.230 --> 38:31.650]  And it's a touch screen, so it's actually a button like in Python, and it just connects back out to a Python script that like does all the things that we just talked about.
[38:31.650 --> 38:33.410]  So it's literally just a one button press.
[38:34.510 --> 38:41.450]  And the specs for the 3D printed case are on Thingiverse, which are linked to on the GitHub account, which if you...
[38:41.450 --> 38:44.990]  Literally, if you just Google for like Rickroll at this point, you get my stuff.
[38:45.390 --> 38:45.850]  But if you...
[38:45.850 --> 38:47.130]  I am serious.
[38:47.330 --> 38:50.650]  But if you just Google for like Chromecast Rickroll, then you'll get pretty much everything you need to.
[38:52.050 --> 38:52.410]  Okay.
[38:52.910 --> 38:53.270]  Joe?
[38:53.270 --> 38:56.950]  Is there any plans for you to actually sell these in mass to people?
[38:57.410 --> 38:58.190]  No, I don't have any...
[38:58.190 --> 39:00.590]  I don't have any grand monetization plan if that's what you're asking.
[39:01.450 --> 39:05.790]  We pretty much have most of the things that we're going to be releasing already out.
[39:06.030 --> 39:11.190]  Although like an actual SD card image is one of the major deliverables that I'm hoping to get out really, really soon.
[39:11.470 --> 39:16.410]  That way you just flash it to an SD card, plug it in, solder the like touch screen, and you're just set.
[39:17.990 --> 39:21.770]  And part two was, I haven't been Rickrolled in like six years and you got me.
[39:21.770 --> 39:22.350]  That was good.
[39:23.890 --> 39:24.370]  I know.
[39:24.450 --> 39:24.930]  I'm bringing it back.
[39:27.550 --> 39:30.390]  Do you happen to live near the Google campus?
[39:30.590 --> 39:32.370]  Because they probably use a few of them there.
[39:32.710 --> 39:33.070]  Yeah, yeah.
[39:33.230 --> 39:34.010]  Well, there's...
[39:34.010 --> 39:34.930]  I don't.
[39:35.010 --> 39:35.450]  I live in Phoenix.
[39:35.590 --> 39:37.210]  So yeah, quick shout out to Phoenix, by the way.
[39:37.710 --> 39:41.890]  If you're ever in the Phoenix area, come down to the Phoenix 2600, first Friday of the month.
[39:42.870 --> 39:45.650]  Or the Hacker Space, Heats and Collapse in downtown Mace.
[39:45.750 --> 39:45.910]  Awesome.
[39:46.470 --> 39:47.130]  What was I going to say?
[39:47.310 --> 39:48.310]  The Chromecast.
[39:48.410 --> 39:50.790]  Oh yeah, the Best Buy.
[39:50.790 --> 39:55.470]  I think certain Best Buys have like a Chromecast like kiosk set up, right?
[39:56.210 --> 39:57.850]  And like, oh, those things are just choice.
[39:58.050 --> 40:03.130]  So I'm not promising anything, but there may be a new YouTube video coming out in the future.
[40:04.730 --> 40:07.410]  I have a possible answer and then a question.
[40:07.530 --> 40:11.610]  The answer is, I believe you asked, what do you have to reboot in order to debug?
[40:11.610 --> 40:11.950]  Yes.
[40:11.950 --> 40:16.170]  And I think an appropriate answer might be, every single VCR made after 1994.
[40:16.570 --> 40:17.030]  Yeah, VCR.
[40:17.510 --> 40:19.570]  We might have to go back to the VCR age though.
[40:19.790 --> 40:19.890]  All right.
[40:20.030 --> 40:29.870]  And my question is that I may have, because I've been hallucinating for the past couple hours due to how long I've been up for, what has been the response for Google on this?
[40:29.870 --> 40:33.170]  Are they furious or are they like, hey, we annoy people, you annoy people.
[40:33.290 --> 40:34.090]  Let's join in on the fun.
[40:34.190 --> 40:35.250]  Like, what's been the response?
[40:35.710 --> 40:35.890]  Yeah, yeah.
[40:35.890 --> 40:37.950]  So generally, like, how has Google been for this?
[40:38.070 --> 40:41.470]  So yeah, we, like I said, I contacted Google like months ago about it.
[40:41.830 --> 40:46.790]  Just kind of disclosed the whole, like, bug or design flaw, if you will, to them.
[40:46.930 --> 40:48.150]  And they were totally cool about it.
[40:48.230 --> 40:52.950]  And they just eventually came to the conclusion that they didn't think it was a huge, like, high-risk thing.
[40:52.950 --> 40:57.470]  Because they deal with problems where, like, people are owning Google servers all the time and, like, getting serious data, right?
[40:57.570 --> 40:59.770]  So, like, in that hierarchy, maybe this is kind of low on the list.
[41:00.310 --> 41:06.030]  And two, like, they didn't, like, there wasn't any clear way to fix it without impacting usability, which is its main thing, right?
[41:07.350 --> 41:09.930]  So they kind of said it was a won't-fix sort of problem.
[41:10.170 --> 41:21.870]  That said, what with the, like, pretty much every, like, article that I've ever read, like, dozens and dozens of them that talked about the Rickmote said that they contacted Google about it and they haven't responded.
[41:21.870 --> 41:28.230]  So I'm like, oh, crap, like, there must be any, like, calls off the hook from, like, reporters talking, like, about the Chromecast.
[41:28.330 --> 41:29.490]  Like, they're going to be really pissed at me now.
[41:29.950 --> 41:31.110]  Quick question to add to that.
[41:31.130 --> 41:35.470]  What has been the most ludicrous reaction in the media that you've seen from this so far?
[41:36.010 --> 41:39.990]  Yeah, well, there seems to be some people, like, oh, man, like, people are going to stream child pornography.
[41:40.750 --> 41:42.510]  Like, won't anybody think of the children?
[41:42.710 --> 41:43.550]  Like, oh, my God.
[41:44.950 --> 41:47.370]  Like, so that was pretty ridiculous.
[41:48.470 --> 41:52.570]  Like, I'm, like, I'm about, like, I write up a big post, like, about to hit the send button.
[41:52.750 --> 41:52.990]  Like, no.
[41:53.190 --> 41:54.010]  Just don't do it.
[41:54.090 --> 41:54.810]  Just don't do it.
[41:55.010 --> 41:55.710]  Just step down.
[41:57.210 --> 41:58.950]  Okay, so have you got any other questions?
[41:59.310 --> 42:01.150]  If not, then I'll go and wrap it up.
[42:01.150 --> 42:02.070]  If not, then I'll go and wrap it up.